Partition Table

Here is how the boot process worked in the early years: BIOS (basic input/output system) initialized devices and delegated control to the operating system. For that purpose, the BIOS addressed the partition table stored in the Master Boot Record of the hard drive. MBR-formatted disks had a maximal capacity of 2 TB and could not exceed four partitions. However, modern hard drives required a radical software upgrade, and MBR gave way to GPT.

In our previous article we were discussing how data recovery tools are able to recover information. In that article we covered FAT, one of the two major file systems used in Windows computers. Today, we’ll be discussing the other file system: the NTFS. The authors of this article used their experience by developing Hetman Partition Recovery, a universal data recovery tool working with both FAT and NTFS formatted devices.

Digital forensics and data recovery walk hand to hand. Developers of forensic analysis tools implement many of the same algorithms and use most of the same techniques available in the recovery tools. There are, however, certain differences in reasoning and approaches between the two categories of tools even aside of the massive price difference.

Data recovery tools for home users and small businesses are utterly different from tools intended for the use by system administrators managing networks of multiple PCs. Tools for system administrators will normally offer certain features that would unnecessarily complicate tools intended for the home user market. In this article, we will have a look at one of such tools, and discuss the features aimed at the sysadmin crowd.